- Email: [email protected]
Secure use of individual patient data from clinical trials
Comment
Secure use of individual patient data from clinical trials
www.thelancet.com Vol 382 September 28, 2013
whether information from two or more sources might be combined to identify individuals. At one extreme, so much information can be removed to protect privacy that the scientific value of IPD analyses is lost. On the other hand, information might be included that could identify sensitive health information about individuals. One approach is to provide IPD to researchers under a controlled system, combined with making other trial information public, such as the main body of industry’s clinical study reports. However, this approach also presents challenges. For example, some reports contain case narratives of the medical histories, treatments, and outcomes of individuals who have had serious adverse events. It might seem reasonable for this information to be made public, particularly as it relates to safety. However, the information could identify individuals. Many journals would not publish such an account without explicit informed consent from the patient concerned.9 Should these data be published in full as part of a publicly available record? Should information be removed, and, if so, how much of it? Or should such case narratives of IPD only be provided to bona-fide researchers? Another practical problem relates to patient identifier numbers. We understand that some data protection authorities in Europe determine that data from each patient can only be considered anonymised if personal information and the code number are removed.10 However, redaction of code numbers makes it impossible to link the treatment and outcomes of individuals. One
Michelle Constantini/Getty Images
Publishing the results of all clinical trials, whoever funds them, is required for ethical, scientific, economic, and societal reasons.1 Individuals who take part in trials need to be sure that data they contribute are used to further knowledge, prevent unnecessary duplication of research, and improve the prospects for patients. Endorsement of these principles is clear in the support received for the UK-based charitable trust Sense about Science’s campaign demanding that all clinical trials should be registered and reported.2 However, although the campaign recognises the advantages of analyses based on individual participant data (IPD), it is not calling for open access to IPD. The campaign recognises that risks to personal privacy must be taken seriously. These risks are not just theoretical: a recent study was able to identify 50 individuals from public websites that contained genetic information.3 The research community must work with others to define what constitutes appropriate protection of identifiable information if it is to retain public trust in the use of IPD. Analyses based on IPD have many advantages. In 1970, The Lancet published a report based on nine trials of anticoagulant therapy after myocardial infarction.4 That study showed how, compared with analyses of aggregate data, access to IPD facilitated more thorough data checking; identified missing information; prompted renewed searches for key outcomes; enabled longitudinal analyses based on serial measurements in individuals; and offered greater reliability of subgroup analyses. Nearly two decades passed before others began to collaborate widely to use IPD analyses. These initiatives from collaborative trialists’ groups resulted in authoritative analyses of direct relevance to patient care in cancer and cardiovascular diseases, among others.5,6 The advantages of IPD analyses have prompted calls for wider access to such data,7 and we support these calls. However, robust arrangements are needed to minimise the risks of breaches of patient confidentiality. The experience gained within trialists’ collaborations is important, since, as far as we are aware, they have an unbroken record of maintaining patient confidentiality in their IPD analyses. The protection of privacy is vital in IPD analyses and anonymisation is a key requirement. The US privacy rule is often cited as the standard to follow in removing patient identifiers,8 although judgment is needed to assess
1073
Comment
solution is to apply a different code number and delete the link between the new code number and the old one. Although not insurmountable, this solution presents practical challenges and costs if applied to all studies across academia and industry. An international standard or approach for sharing of clinical trial information, which draws on the experience of collaborative trialists’ groups that use IPD, needs to be established to balance the benefits to society of enabling more rigorous research analysis with acceptable risks to privacy. What approach to privacy should be taken when making trial information public? How can the importance of information that has been removed to protect privacy be assessed and by whom? Can minimally anonymised information be made available to other researchers? What controls, if any, need to be in place? The answers to these questions require a pragmatic consensus that includes policy makers, researchers, privacy experts, and patients. Sharing clinical trial information and data is as critically important as the protection of privacy, and there is an urgent need for an informed debate and agreed standards. We believe that it would be useful to have an independent body to host data to provide common format and access mechanisms, and to ensure transparency over requests and access decisions, or refusal. Single instances of abuse of access to personal data can have far reaching effects. The UK’s system of personal identity cards, which was introduced for reasons of national security at the beginning of World War II, was abolished in 1952. This was because the police had wrongly demanded that Clarence Willcock produce his personal identity card in connection with an alleged driving offence.11 We cannot afford to risk an abuse of
privacy leading to a reaction that would legislate against use of IPD. *Patrick Vallance, Iain Chalmers GlaxoSmithKline, Brentford, Middlesex TW8 9GS, UK (PV); and James Lind Initiative, Oxford, UK (IC) [email protected] PV is a President at GlaxoSmithKline, holds stock or stock options in GlaxoSmithKline, and is a board member of A*Star Board Singapore and Genome Research Limited. IC declares that he has no conflicts of interest. The authors would like to thank Martin Bobrow, Mike Clarke, and Ben Goldacre for helpful comments and critical review of this Comment. 1 2
3 4
5
6 7
8
9
10
11
Chalmers I, Glasziou P, Godlee F. All trials must be registered and the results published. BMJ 2013; 346: f105. AllTrials. All trials registered. All results reported. August, 2013. http://www. alltrials.net/wp-content/uploads/2013/08/What-does-all-trials-registeredand-reported-mean.pdf (accessed Aug 7, 2013). Gymrek M, McGuire AL, Golan D, Halperin E, Erlich Y. Identifying personal genomes by surname inference. Science 2013; 339: 321–24. International Anticoagulant Review Group. Collaborative analysis of long-term anti-coagulant administration after acute myocardial infarction. Lancet 1970; 295: 203–09. Early Breast Cancer Trialists’ Collaborative Group. Effects of adjuvant tamoxifen and of cytotoxic therapy on mortality in early breast cancer. An overview of 61 randomized trials among 28,896 women. N Engl J Med 1988; 319: 1681–92. Antiplatelet Trialists’ Collaboration. Secondary prevention of vascular disease by prolonged anti-platelet treatment. BMJ 1988; 296: 320–31. The Royal Society. Science as an open enterprise. The Royal Society Science Policy Centre report 02/12. London: The Royal Society, 2012. http:// royalsociety.org/uploadedFiles/Royal_Society_Content/policy/projects/ sape/2012-06-20-SAOE.pdf (accessed Aug 7, 2013). Department of Health and Human Services. Code of Federal Regulations.Title 45: public welfare, subtitle A §164.514. 2011 edition. http://www.gpo.gov/ fdsys/pkg/CFR-2011-title45-vol1/pdf/CFR-2011-title45-vol1-sec164-514.pdf (accessed Sept 20, 2013). BMJ. BMJ policy patient confidentiality. http://www.bmj.com/about-bmj/ resources-authors/forms-policies-and-checklists/patient-confidentiality (accessed Aug 7, 2013). Working Party on the Protection of Individuals with Regard to the Processing of Personal Data. Article 29 Data Protection Working Party. Opinion 4/2007 on the concept of personal data. 01248/07/EN WP 136. 2007. http:// ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf (accessed Aug 7, 2013). Agar J. Identity cards in Britain; past experience and policy implications. History and Policy, 2005. http://www.historyandpolicy.org/papers/ policy-paper-33.html (accessed Aug 7, 2013).
Total hip replacement: mortality and risks See Articles page 1097
1074
Total hip arthroplasty for treatment of end-stage hip arthritis that is non-responsive to non-operative management is one of the most clinically successful and cost-effective orthopaedic procedures, and is generally considered a safe operation that can reduce pain and increase function and quality of life.1,2 Although postoperative mortality within 90 days after total hip arthroplasty is low, it is a subject of importance that needs to be quantified. More than 285 000 total hip replacements are done each year in the USA. With this
number expected to increase over the next 20 years,3 a more detailed understanding of mortality after this procedure could help orthopaedic surgeons to improve the care of their patients, as well as educate patients about potential complications, and ultimately reduce related morbidities. Several studies4–9 have attempted to identify contributing risk factors that might increase the mortality rate after total hip arthroplasty. However, most reports are based on small case series compared with the number www.thelancet.com Vol 382 September 28, 2013
Secure use of individual patient data from clinical trials
www.thelancet.com Vol 382 September 28, 2013
whether information from two or more sources might be combined to identify individuals. At one extreme, so much information can be removed to protect privacy that the scientific value of IPD analyses is lost. On the other hand, information might be included that could identify sensitive health information about individuals. One approach is to provide IPD to researchers under a controlled system, combined with making other trial information public, such as the main body of industry’s clinical study reports. However, this approach also presents challenges. For example, some reports contain case narratives of the medical histories, treatments, and outcomes of individuals who have had serious adverse events. It might seem reasonable for this information to be made public, particularly as it relates to safety. However, the information could identify individuals. Many journals would not publish such an account without explicit informed consent from the patient concerned.9 Should these data be published in full as part of a publicly available record? Should information be removed, and, if so, how much of it? Or should such case narratives of IPD only be provided to bona-fide researchers? Another practical problem relates to patient identifier numbers. We understand that some data protection authorities in Europe determine that data from each patient can only be considered anonymised if personal information and the code number are removed.10 However, redaction of code numbers makes it impossible to link the treatment and outcomes of individuals. One
Michelle Constantini/Getty Images
Publishing the results of all clinical trials, whoever funds them, is required for ethical, scientific, economic, and societal reasons.1 Individuals who take part in trials need to be sure that data they contribute are used to further knowledge, prevent unnecessary duplication of research, and improve the prospects for patients. Endorsement of these principles is clear in the support received for the UK-based charitable trust Sense about Science’s campaign demanding that all clinical trials should be registered and reported.2 However, although the campaign recognises the advantages of analyses based on individual participant data (IPD), it is not calling for open access to IPD. The campaign recognises that risks to personal privacy must be taken seriously. These risks are not just theoretical: a recent study was able to identify 50 individuals from public websites that contained genetic information.3 The research community must work with others to define what constitutes appropriate protection of identifiable information if it is to retain public trust in the use of IPD. Analyses based on IPD have many advantages. In 1970, The Lancet published a report based on nine trials of anticoagulant therapy after myocardial infarction.4 That study showed how, compared with analyses of aggregate data, access to IPD facilitated more thorough data checking; identified missing information; prompted renewed searches for key outcomes; enabled longitudinal analyses based on serial measurements in individuals; and offered greater reliability of subgroup analyses. Nearly two decades passed before others began to collaborate widely to use IPD analyses. These initiatives from collaborative trialists’ groups resulted in authoritative analyses of direct relevance to patient care in cancer and cardiovascular diseases, among others.5,6 The advantages of IPD analyses have prompted calls for wider access to such data,7 and we support these calls. However, robust arrangements are needed to minimise the risks of breaches of patient confidentiality. The experience gained within trialists’ collaborations is important, since, as far as we are aware, they have an unbroken record of maintaining patient confidentiality in their IPD analyses. The protection of privacy is vital in IPD analyses and anonymisation is a key requirement. The US privacy rule is often cited as the standard to follow in removing patient identifiers,8 although judgment is needed to assess
1073
Comment
solution is to apply a different code number and delete the link between the new code number and the old one. Although not insurmountable, this solution presents practical challenges and costs if applied to all studies across academia and industry. An international standard or approach for sharing of clinical trial information, which draws on the experience of collaborative trialists’ groups that use IPD, needs to be established to balance the benefits to society of enabling more rigorous research analysis with acceptable risks to privacy. What approach to privacy should be taken when making trial information public? How can the importance of information that has been removed to protect privacy be assessed and by whom? Can minimally anonymised information be made available to other researchers? What controls, if any, need to be in place? The answers to these questions require a pragmatic consensus that includes policy makers, researchers, privacy experts, and patients. Sharing clinical trial information and data is as critically important as the protection of privacy, and there is an urgent need for an informed debate and agreed standards. We believe that it would be useful to have an independent body to host data to provide common format and access mechanisms, and to ensure transparency over requests and access decisions, or refusal. Single instances of abuse of access to personal data can have far reaching effects. The UK’s system of personal identity cards, which was introduced for reasons of national security at the beginning of World War II, was abolished in 1952. This was because the police had wrongly demanded that Clarence Willcock produce his personal identity card in connection with an alleged driving offence.11 We cannot afford to risk an abuse of
privacy leading to a reaction that would legislate against use of IPD. *Patrick Vallance, Iain Chalmers GlaxoSmithKline, Brentford, Middlesex TW8 9GS, UK (PV); and James Lind Initiative, Oxford, UK (IC) [email protected] PV is a President at GlaxoSmithKline, holds stock or stock options in GlaxoSmithKline, and is a board member of A*Star Board Singapore and Genome Research Limited. IC declares that he has no conflicts of interest. The authors would like to thank Martin Bobrow, Mike Clarke, and Ben Goldacre for helpful comments and critical review of this Comment. 1 2
3 4
5
6 7
8
9
10
11
Chalmers I, Glasziou P, Godlee F. All trials must be registered and the results published. BMJ 2013; 346: f105. AllTrials. All trials registered. All results reported. August, 2013. http://www. alltrials.net/wp-content/uploads/2013/08/What-does-all-trials-registeredand-reported-mean.pdf (accessed Aug 7, 2013). Gymrek M, McGuire AL, Golan D, Halperin E, Erlich Y. Identifying personal genomes by surname inference. Science 2013; 339: 321–24. International Anticoagulant Review Group. Collaborative analysis of long-term anti-coagulant administration after acute myocardial infarction. Lancet 1970; 295: 203–09. Early Breast Cancer Trialists’ Collaborative Group. Effects of adjuvant tamoxifen and of cytotoxic therapy on mortality in early breast cancer. An overview of 61 randomized trials among 28,896 women. N Engl J Med 1988; 319: 1681–92. Antiplatelet Trialists’ Collaboration. Secondary prevention of vascular disease by prolonged anti-platelet treatment. BMJ 1988; 296: 320–31. The Royal Society. Science as an open enterprise. The Royal Society Science Policy Centre report 02/12. London: The Royal Society, 2012. http:// royalsociety.org/uploadedFiles/Royal_Society_Content/policy/projects/ sape/2012-06-20-SAOE.pdf (accessed Aug 7, 2013). Department of Health and Human Services. Code of Federal Regulations.Title 45: public welfare, subtitle A §164.514. 2011 edition. http://www.gpo.gov/ fdsys/pkg/CFR-2011-title45-vol1/pdf/CFR-2011-title45-vol1-sec164-514.pdf (accessed Sept 20, 2013). BMJ. BMJ policy patient confidentiality. http://www.bmj.com/about-bmj/ resources-authors/forms-policies-and-checklists/patient-confidentiality (accessed Aug 7, 2013). Working Party on the Protection of Individuals with Regard to the Processing of Personal Data. Article 29 Data Protection Working Party. Opinion 4/2007 on the concept of personal data. 01248/07/EN WP 136. 2007. http:// ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf (accessed Aug 7, 2013). Agar J. Identity cards in Britain; past experience and policy implications. History and Policy, 2005. http://www.historyandpolicy.org/papers/ policy-paper-33.html (accessed Aug 7, 2013).
Total hip replacement: mortality and risks See Articles page 1097
1074
Total hip arthroplasty for treatment of end-stage hip arthritis that is non-responsive to non-operative management is one of the most clinically successful and cost-effective orthopaedic procedures, and is generally considered a safe operation that can reduce pain and increase function and quality of life.1,2 Although postoperative mortality within 90 days after total hip arthroplasty is low, it is a subject of importance that needs to be quantified. More than 285 000 total hip replacements are done each year in the USA. With this
number expected to increase over the next 20 years,3 a more detailed understanding of mortality after this procedure could help orthopaedic surgeons to improve the care of their patients, as well as educate patients about potential complications, and ultimately reduce related morbidities. Several studies4–9 have attempted to identify contributing risk factors that might increase the mortality rate after total hip arthroplasty. However, most reports are based on small case series compared with the number www.thelancet.com Vol 382 September 28, 2013